diff options
| author | jhb <jhb@FreeBSD.org> | 2002-09-09 18:24:35 +0000 |
|---|---|---|
| committer | jhb <jhb@FreeBSD.org> | 2002-09-09 18:24:35 +0000 |
| commit | 8c0aa78c1bfd8dfcef0d53c462114020d798e2e6 (patch) | |
| tree | e36d98dfc29af054d030f2e56e24c908dec7c52b | |
| parent | 99d704377a73193a1be48d9aff73fd7d79cb88c0 (diff) | |
| download | FreeBSD-src-8c0aa78c1bfd8dfcef0d53c462114020d798e2e6.zip FreeBSD-src-8c0aa78c1bfd8dfcef0d53c462114020d798e2e6.tar.gz | |
Make sure a $PIR table header has a valid length before accepting the table
as valid.
Submitted by: Michal Mertl <mime@traveller.cz>
| -rw-r--r-- | sys/amd64/pci/pci_cfgreg.c | 3 | ||||
| -rw-r--r-- | sys/i386/pci/pci_cfgreg.c | 3 | ||||
| -rw-r--r-- | sys/i386/pci/pci_pir.c | 3 |
3 files changed, 6 insertions, 3 deletions
diff --git a/sys/amd64/pci/pci_cfgreg.c b/sys/amd64/pci/pci_cfgreg.c index 1562fd9..0d943f3 100644 --- a/sys/amd64/pci/pci_cfgreg.c +++ b/sys/amd64/pci/pci_cfgreg.c @@ -169,7 +169,8 @@ pci_cfgregopen(void) i < (pt->pt_header.ph_length); i++) { ck += cv[i]; } - if (ck == 0) { + if (ck == 0 && pt->pt_header.ph_length > + sizeof(struct PIR_header)) { pci_route_table = pt; pci_route_count = (pt->pt_header.ph_length - sizeof(struct PIR_header)) / diff --git a/sys/i386/pci/pci_cfgreg.c b/sys/i386/pci/pci_cfgreg.c index 1562fd9..0d943f3 100644 --- a/sys/i386/pci/pci_cfgreg.c +++ b/sys/i386/pci/pci_cfgreg.c @@ -169,7 +169,8 @@ pci_cfgregopen(void) i < (pt->pt_header.ph_length); i++) { ck += cv[i]; } - if (ck == 0) { + if (ck == 0 && pt->pt_header.ph_length > + sizeof(struct PIR_header)) { pci_route_table = pt; pci_route_count = (pt->pt_header.ph_length - sizeof(struct PIR_header)) / diff --git a/sys/i386/pci/pci_pir.c b/sys/i386/pci/pci_pir.c index 1562fd9..0d943f3 100644 --- a/sys/i386/pci/pci_pir.c +++ b/sys/i386/pci/pci_pir.c @@ -169,7 +169,8 @@ pci_cfgregopen(void) i < (pt->pt_header.ph_length); i++) { ck += cv[i]; } - if (ck == 0) { + if (ck == 0 && pt->pt_header.ph_length > + sizeof(struct PIR_header)) { pci_route_table = pt; pci_route_count = (pt->pt_header.ph_length - sizeof(struct PIR_header)) / |
